For now, the way I think about this scenario is that an attacker can have physical access to one of the following:Įven with any one of these devices in their possession, the adversary should never be able to access any of our data or accounts. This is the situation where an attacker has physical access to a device (i.e. If an account or password has been compromised, our data and accounts on other services should still be protected.

Personal information dumps from poorly secured servicesĪn attacker, even with these tools, should not be able to get into our accounts.

This is the situation where an attacker doesn’t have physical access to your system. If you have such a determined attacker trying to break into your system, then you probably have bigger problems than reading this blog post. This is important because an adversary with significant resources (e.g. Threat modelīefore delving into the details, we should take a moment to lay out a threat model – the types of attacks that an attacker is permitted to perform and that our setup should be able to reasonably defend against.

This post covers the first steps I took towards that end, starting with password generation and better two-factor authentication.

In the last few weeks, I started to change that and significantly upgraded my personal security. This means I had a lot of configuration set up for convenience, but without much in the way of security. I’m someone who’s been reasonably technical for a long time, but was not really interested in security until about a year and a half ago.

Bitwarden totp not working